Last Comment Bug 715056 - "ASSERTION: wrong node" and crash [@ nsIRange::UnregisterCommonAncestor]
: "ASSERTION: wrong node" and crash [@ nsIRange::UnregisterCommonAncestor]
Status: RESOLVED FIXED
[inbound]
: assertion, crash, testcase
Product: Core
Classification: Components
Component: Selection (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla12
Assigned To: Mats Palmgren (:mats)
:
Mentors:
Depends on:
Blocks: 326633
  Show dependency treegraph
 
Reported: 2012-01-03 19:53 PST by Jesse Ruderman
Modified: 2012-01-09 15:10 PST (History)
2 users (show)
mats: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (crashes Firefox when closed) (339 bytes, text/html)
2012-01-03 19:53 PST, Jesse Ruderman
no flags Details
stack trace (10.81 KB, text/plain)
2012-01-03 19:53 PST, Jesse Ruderman
no flags Details
fix (2.94 KB, patch)
2012-01-04 12:23 PST, Mats Palmgren (:mats)
bugs: review+
Details | Diff | Splinter Review
crashtest (1.17 KB, patch)
2012-01-04 12:24 PST, Mats Palmgren (:mats)
no flags Details | Diff | Splinter Review

Description Jesse Ruderman 2012-01-03 19:53:00 PST
Created attachment 585640 [details]
testcase (crashes Firefox when closed)

Closing the testcase triggers:

###!!! ASSERTION: wrong node: 'aNode->IsCommonAncestorForRangeInSelection()', file /builds/slave/m-cen-osx64-dbg/build/content/base/src/nsRange.cpp, line 429

Crash [@ nsIRange::UnregisterCommonAncestor]
Comment 1 Jesse Ruderman 2012-01-03 19:53:19 PST
Created attachment 585641 [details]
stack trace
Comment 2 Mats Palmgren (:mats) 2012-01-04 03:30:15 PST
The text nodes we're normalizing are children of the document, so we're falsely
triggering aNotInsertedYet==true in nsRange::CharacterDataChanged:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#556
because I should have used GetNodeParent(), not GetParent().  Bah!

Try results pending:
https://tbpl.mozilla.org/?tree=Try&rev=5b0e7f840554
Comment 3 Mats Palmgren (:mats) 2012-01-04 12:23:44 PST
Created attachment 585853 [details] [diff] [review]
fix
Comment 4 Mats Palmgren (:mats) 2012-01-04 12:24:09 PST
Created attachment 585854 [details] [diff] [review]
crashtest

Note You need to log in before you can comment on or make changes to this bug.